[TBExtent]

Cherry pick of:
1008093: Add support for authentication when downloading deployment images | https://review.opendev.org/c/openstack/bifrost/+/1008093

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: stackhpc/stackhpc-kayobe-config/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: a9b1b928-682f-47c2-834d-ceb7ba7d6daa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

The Bifrost base source reference and deployment image tags are updated. Three Tenks jobs are enabled in the check-review and gate pipelines.

Changes: Bifrost image configuration

Layer / File(s)	Summary
Update Bifrost image references etc/kayobe/kolla.yml, etc/kayobe/kolla-image-tags.yml	The bifrost-base source reference changes to bugfix/2026.1-prevent-leaks. The Rocky 10 and Ubuntu Noble bifrost_deploy image tags change to 20261015T125339.

Tenks CI jobs

Layer / File(s)	Summary
Enable Tenks jobs zuul.d/project.yaml	The tenks-ubuntu-noble, tenks-rocky-9 and tenks-rocky-10 jobs are enabled in both check-review and gate.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 7667c

The Rocky 9 Tenks job will fail during Pulp configuration in review and gate. Add the missing Rocky 9 configuration or leave that job disabled before merging.

Pre-merge checks: 3

Passed checks: 3 passed

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository: stackhpc/stackhpc-kayobe-config/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: f4d91c5c-b948-4c10-81e2-ad3141036af0

📥 Commits

Reviewing files that changed from the base of the PR and between f783a20 and 7667c72.

📒 Files selected for processing: 3

• etc/kayobe/kolla-image-tags.yml
• etc/kayobe/kolla.yml
• zuul.d/project.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🔎 Supported by static analysis

🏁 Script executed:

rg -n 'kolla_base_distro_and_version|kolla_base_distro|kolla_base_distro_version|get_parent_tag|list-tags|pulp-container-sync' etc/kayobe tools
sed -n '90,125p' tools/kolla-images.py
sed -n '190,220p' tools/kolla-images.py
sed -n '245,305p' tools/kolla-images.py

Repository: stackhpc/stackhpc-kayobe-config

Length of output: 9887

---

🏁 Script executed:

set -o pipefail
printf '%s\n' '--- changed job context ---'
nl -ba zuul.d/project.yaml | sed -n '1,35p'
printf '%s\n' '--- tenks job definitions and deployment references ---'
rg -n -F --glob '*.yaml' --glob '*.yml' --glob '*.sh' -e 'tenks-rocky-9' -e 'tenks-ubuntu-noble' -e 'tenks-rocky-10' -e 'automated-deployment.sh' -e 'ci-tenks' zuul.d etc/kayobe
printf '%s\n' '--- ci-tenks globals ---'
nl -ba etc/kayobe/environments/ci-tenks/globals.yml | sed -n '1,45p'
printf '%s\n' '--- ci-tenks deployment script ---'
nl -ba etc/kayobe/environments/ci-tenks/automated-deployment.sh | sed -n '1,145p'
printf '%s\n' '--- kolla globals ---'
nl -ba etc/kayobe/kolla/globals.yml | sed -n '1,35p'
printf '%s\n' '--- get_parent_tag_name and resolver flow ---'
nl -ba tools/kolla-images.py | sed -n '155,215p'
printf '%s\n' '--- Pulp image-tag selection blocks ---'
nl -ba etc/kayobe/pulp.yml | sed -n '690,755p'
printf '%s\n' '--- tag definitions ---'
nl -ba etc/kayobe/kolla-image-tags.yml | sed -n '1,40p'

Repository: stackhpc/stackhpc-kayobe-config

Length of output: 17868

---

🏁 Script executed:

set -o pipefail
for f in zuul.d/project.yaml zuul.d/jobs.yaml etc/kayobe/environments/ci-tenks/globals.yml etc/kayobe/environments/ci-tenks/automated-deployment.sh etc/kayobe/kolla/globals.yml etc/kayobe/pulp.yml etc/kayobe/kolla-image-tags.yml tools/kolla-images.py; do
  test -f "$f" || continue
  printf '\n--- %s ---\n' "$f"
  nl -ba "$f" | sed -n '1,460p'
done

Repository: stackhpc/stackhpc-kayobe-config

Length of output: 42915

---

🏁 Script executed:

set -o pipefail
printf '%s\n' '--- ci-tenks files ---'
rg --files etc/kayobe/environments/ci-tenks | sort
printf '%s\n' '--- seed and inventory distro/image references ---'
rg -n -F --glob '*' -e 'seed' -e 'image' -e 'distribution' -e 'os_release' -e 'rocky' etc/kayobe/environments/ci-tenks | sed -n '1,260p'
printf '%s\n' '--- Pulp playbook definitions and imports ---'
rg -n -F --glob '*.yml' --glob '*.yaml' -e 'hosts:' -e 'kolla_base_distro_and_version' -e 'stackhpc_pulp_repository_container_repos_kolla' -e 'pulp-container-sync' etc/kayobe/ansible etc/kayobe | sed -n '1,260p'
printf '%s\n' '--- tenks configuration ---'
if test -f etc/kayobe/environments/ci-tenks/tenks.yml; then nl -ba etc/kayobe/environments/ci-tenks/tenks.yml; fi
printf '%s\n' '--- ci-tenks inventory files ---'
find etc/kayobe/environments/ci-tenks/inventory -type f -maxdepth 4 -print -exec sh -c 'echo --- $1; nl -ba "$1"' sh {} \;

Repository: stackhpc/stackhpc-kayobe-config

Length of output: 43447

---

🏁 Script executed:

set -o pipefail
printf '%s\n' '--- Pulp sync play ---'
nl -ba etc/kayobe/ansible/pulp/pulp-container-sync.yml | sed -n '1,80p'
printf '%s\n' '--- Kayobe kolla variable declarations ---'
nl -ba etc/kayobe/kolla.yml | sed -n '65,95p'
printf '%s\n' '--- Pulp image list and unbuildable declarations ---'
nl -ba etc/kayobe/pulp.yml | sed -n '650,755p'
printf '%s\n' '--- exact PR job diff ---'
git diff f783a20ca4e4e97cff0181fb0cad99d2d7853b1a 7667c7236ec3d51f8c80b3b8c78684fbc18fa984 -- zuul.d/project.yaml

Repository: stackhpc/stackhpc-kayobe-config

Length of output: 7730

---

Do not enable tenks-rocky-9 until Rocky 9 image data is supported.

The Rocky 9 job runs the Pulp synchronisation play on localhost. On the Rocky 9 Zuul node, kolla_base_distro_and_version resolves to rocky-9. The Pulp templates then index stackhpc_kolla_unbuildable_images[rocky-9], but that mapping has entries only for rocky-10 and ubuntu-noble. Ansible can therefore fail while rendering the Pulp repositories, before it synchronises bifrost.

The failure is not a missing Rocky 9 bifrost_deploy parent tag. list-tags uses its default rocky-10 and ubuntu-noble inputs, and bifrost_deploy has explicit tags for both. It does not call get_parent_tag with rocky-9.

Suggested fix

         - tenks-ubuntu-noble
-        - tenks-rocky-9
         - tenks-rocky-10
...
         - tenks-ubuntu-noble
-        - tenks-rocky-9
         - tenks-rocky-10

[MoteHue]

Approval to test CI. Here's hoping 🤞